endur liquid staking token lst

Cairo Security Clan22 Nov 2024Files named in the report

Cairo Security Clan reviewed Endur (endur liquid staking token lst) on 22 Nov 2024: 8 findings, 0 critical; 6 marked fixed, 2 open.

No open critical findings

Open the report Open Endur’s security record

Report stored on IPFS. Content hash bafybeiacorscatpuxy625b4a5qkt3kpxakvcukitl7okuuzpshc6uaberm

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	2
Medium	0	1
Low	2	3

Highattacker could perform dos attack on withdrawal queue by donating 1 weiFixed

The take_funds function is permissionless, enabling any address to call it and donate an arbitrary amount of funds such as 1 wei. This can cause the original unstaking flow to fail by artificially reducing the intransit_amount and breaking withdrawal processing.

Highexit_delegation_pool_action can be called directly, bypassing unstake_action functionFixed

The unstaking process in the delegator contract consists of two steps. The function exit_delegation_pool_action can be called by anyone for any address, which allows an attacker to bypass the unstake_action function. This causes internal accounting corruption preventing users in the withdrawal queue from properly withdrawing their funds.

Mediumfunction _unclaimed_rewards does not subtract commission of delegation poolFixed

The report gives no description here.

Low_process_claim could revert due to breaking the gas limitFixed

The report gives no description here.

Lowfunction adjust_mint should be called before _convert_to_assetsFixed

The report gives no description here.

Lowunnecessary storage usageFixed

The report gives no description here.